To create a VM (a domain in Xen terminology, sometimes called a guest)
with xl requires the provision of a domain config file. Typically
these live in `/etc/xen/DOMAIN.cfg` where DOMAIN is the name of the
domain.

Specifies that this is to be an HVM domain. That is, a fully
virtualised computer with emulated BIOS, disk and network peripherals,
etc. The default is a PV domain, suitable for hosting Xen-aware guest
operating systems.

To allow all the vcpus of the guest to run on cpus 0,2,3,5. Combining
this with "all" is possible, meaning "all,^7" results in all the vcpus
of the guest running on all the cpus on the host except cpu 7.

To allow all the vcpus of the guest to run on the cpus from NUMA nodes
0,1,3 of the host. So, if cpus 0-3 belongs to node 0, cpus 4-7 belongs
to node 1 and cpus 8-11 to node 3, the above would mean all the vcpus
of the guest will run on cpus 0-3,8-11.

Combining this notation with the one above is possible. For instance,
"1,node:2,^6", means all the vcpus of the guest will run on cpu 1 and
on all the cpus of NUMA node 2, but not on cpu 6. Following the same
example as above, that would be cpus 1,4,5,7.

Combining this with "all" is also possible, meaning "all,^nodes:1"
results in all the vcpus of the guest running on all the cpus on the
host, except for the cpus belonging to the host NUMA node 1.

To ask for specific vcpu mapping. That means (in this example), vcpu 0
of the guest will run on cpu 2 of the host and vcpu 1 of the guest will
run on cpus 3,4,6,7,8 of the host.

More complex notation can be also used, exactly as described above. So
"all,^5-8", or just "all", or "node:0,node:2,^9-11,18-20" are all legal,
for each element of the list.

If this option is not specified, no vcpu to cpu pinning is established,
and the vcpus of the guest can run on all the cpus of the host. If this
option is specified, the intersection of the vcpu pinning mask, provided
here, and the soft affinity mask, provided via cpus\_soft= (if any),
is utilized to compute the domain node-affinity, for driving memory
allocations.

Exactly as cpus=, but specifies soft affinity, rather than pinning
(hard affinity). When using the credit scheduler, this means what cpus
the vcpus of the domain prefer.

A CPU-LIST is specified exactly as above, for cpus=.

If this option is not specified, the vcpus of the guest will not have
any preference regarding on what cpu to run. If this option is specified,
the intersection of the soft affinity mask, provided here, and the vcpu
pinning, provided via cpus= (if any), is utilized to compute the
domain node-affinity, for driving memory allocations.

If this option is not specified (and cpus= is not specified either),
libxl automatically tries to place the guest on the least possible
number of nodes. A heuristic approach is used for choosing the best
node (or set of nodes), with the goal of maximizing performance for
the guest and, at the same time, achieving efficient utilization of
host cpus and memory. In that case, the soft affinity of all the vcpus
of the domain will be set to the pcpus belonging to the NUMA nodes
chosen during placement.

A domain with a weight of 512 will get twice as much CPU as a domain
with a weight of 256 on a contended host.
Legal weights range from 1 to 65535 and the default is 256.
Honoured by the credit, credit2 and sedf schedulers.

The cap optionally fixes the maximum amount of CPU a domain will be
able to consume, even if the host system has idle CPU cycles.
The cap is expressed in percentage of one physical CPU:
100 is 1 physical CPU, 50 is half a CPU, 400 is 4 CPUs, etc.
The default, 0, means there is no upper cap.
Honoured by the credit and credit2 schedulers.

NB: Many systems have features that will scale down the computing
power of a cpu that is not 100% utilized. This can be in the
operating system, but can also sometimes be below the operating system
in the BIOS. If you set a cap such that individual cores are running
at less than 100%, this may have an impact on the performance of your
workload over and above the impact of the cap. For example, if your
processor runs at 2GHz, and you cap a vm at 50%, the power management
system may also reduce the clock speed to 1GHz; the effect will be
that your VM gets 25% of the available power (50% of 1GHz) rather than
50% (50% of 2GHz). If you are not getting the performance you expect,
look at performance and cpufreq options in your operating system and
your BIOS.

Specifies the maximum amount of memory a guest can ever see.
The value of maxmem= must be equal or greater than memory=.

In combination with memory= it will start the guest "pre-ballooned",
if the values of memory= and maxmem= differ.
A "pre-ballooned" HVM guest needs a balloon driver, without a balloon driver
it will crash.

Append cmdline="STRING" to the kernel command line. (Note: it is
guest specific what meaning this has). It can replace root="STRING"
plus extra="STRING" and is preferred. When cmdline="STRING" is set,
root="STRING" and extra="STRING" will be ignored.

Specify an XSM security label used for this domain temporarily during
its build. The domain's XSM label will be changed to the execution
seclabel (specified by "seclabel") once the build is complete, prior to
unpausing the domain. With a properly constructed security policy (such
as nomigrate_t in the example policy), this can be used to build a
domain whose memory is not accessible to the toolstack domain.

Disable migration of this domain. This enables certain other features
which are incompatible with migration. Currently this is limited to
enabling the invariant TSC feature flag in cpuid results when TSC is
not emulated.

Specify the backend domain name of id. This value is required!
If this domain is a guest, the backend should be set to the
vtpm domain name. If this domain is a vtpm, the
backend should be set to the vtpm manager domain name.

Specify the uuid of this vtpm device. The uuid is used to uniquely
identify the vtpm device. You can create one using the uuidgen
program on unix systems. If left unspecified, a new uuid
will be randomly generated every time the domain boots.
If this is a vtpm domain, you should specify a value. The
value is optional if this is a guest domain.

Specifies the paravirtual framebuffer devices which should be supplied
to the domain.

This options does not control the emulated graphics card presented to
an HVM guest. See Emulated VGA Graphics Device below for how to
configure the emulated device. If Emulated VGA Graphics Device options
are used in a PV guest configuration, xl will pick up vnc, vnclisten,
vncpasswd, vncdisplay, vncunused, sdl, opengl and
keymap to construct paravirtual framebuffer device for the guest.

Each VFB_SPEC_STRING is a comma-separated list of KEY=VALUE
settings, from the following list:

Specifies the path to the X authority file that should be used to
connect to the X server when the sdl option is used. Note: passing
this value to the device-model is not currently implemented, so
providing this option will have no effect.

Enable OpenGL acceleration of the SDL display. Only effects machines
using device_model_version="qemu-xen-traditional" and only if the
device-model was compiled with OpenGL support. Disabled by default.

Configure the keymap to use for the keyboard associated with this
display. If the input method does not easily support raw keycodes
(e.g. this is often the case when using VNC) then this allows us to
correctly map the input keys into keycodes seen by the guest. The
specific values which are accepted are defined by the version of the
device-model which you are using. See Keymaps below or consult the
qemu(1) manpage. The default is en-us.

Specifies the virtual channels to be provided to the guest. A
channel is a low-bandwidth, bidirectional byte stream, which resembles
a serial link. Typical uses for channels include transmitting VM
configuration after boot and signalling to in-guest agents. Please see
docs/misc/channels.txt for more details.

Each CHANNEL_SPEC_STRING is a comma-separated list of KEY=VALUE
seettings. Leading and trailing whitespace is ignored in both KEY and
VALUE. Neither KEY nor VALUE may contain ',', '=' or '"'. Defined values
are:

Specify the string name for this device. This parameter is mandatory.
This should be a well-known name for the specific application (e.g.
guest agent) and should be used by the frontend to connect the
application to the right channel device. There is no formal registry
of channel names, so application authors are encouraged to make their
names unique by including domain name and version number in the string
(e.g. org.mydomain.guestagent.1).

Identifies the PCI device from the host perspective in domain
(DDDD), Bus (BB), Device (DD) and Function (F) syntax. This is
the same scheme as used in the output of lspci for the device in
question. Note: By default lspci will omit the domain (DDDD) if it
is zero and it is optional here also. You may specify the function
(F) as * to indicate all functions.

(PV only) By default pciback only allows PV guests to write "known
safe" values into PCI config space. But many devices require writes
to other areas of config space in order to operate properly. This
tells the pciback driver to allow all writes to PCI config space of
this device by this domain. This option should be enabled with
caution: it gives the guest much more control over the device, which
may have security or stability implications. It is recommended to
enable this option only for trusted VMs under administrator control.

Specifies that MSI-INTx translation should be turned on for the PCI
device. When enabled, MSI-INTx translation will always enable MSI on
the PCI device regardless whether the guest uses INTx or MSI. Some
device drivers, such as NVIDIA's, detect an inconsistency and do not
function when this option is enabled. Therefore the default is false (0).

Enable graphics device PCI passthrough. This option makes an assigned
PCI graphics card become primary graphics card in the VM. The QEMU
emulated graphics adapter is disabled and the VNC console for the VM
will not have any graphics output. All graphics output, including boot
time QEMU BIOS messages from the VM, will go to the physical outputs
of the passedthrough physical graphics card.

The graphics card PCI device to passthrough is chosen with pci
option, exactly in the same way as normal Xen PCI device
passthrough/assignment is done. Note that gfx_passthru does not do
any kind of sharing of the GPU, so you can only assign the GPU to one
single VM at a time.

gfx_passthru also enables various legacy VGA memory ranges, BARs, MMIOs,
and ioports to be passed thru to the VM, since those are required
for correct operation of things like VGA BIOS, text mode, VBE, etc.

Enabling gfx_passthru option also copies the physical graphics card
video BIOS to the guest memory, and executes the VBIOS in the guest
to initialize the graphics card.

gfx_passthru is currently only supported with the qemu-xen-traditional
device-model. Upstream qemu-xen device-model currently does not have
support for gfx_passthru.

Note that some graphics adapters (AMD/ATI cards, for example) do not
necessarily require gfx_passthru option, so you can use the normal Xen
PCI passthrough to assign the graphics card as a secondary graphics
card to the VM. The QEMU-emulated graphics card remains the primary
graphics card, and VNC output is available from the QEMU-emulated
primary adapter.

IOMEM_START is a physical page number. NUM_PAGES is the number of pages
beginning with START_PAGE to allow access. GFN specifies the guest frame
number where the mapping will start in the domU's address space. If GFN is
not given, the mapping will be performed using IOMEM_START as a start in the
domU's address space, therefore performing an 1:1 mapping as default.
All of these values must be given in hexadecimal.

Note that the IOMMU won't be updated with the mappings specified with this
option. This option therefore should not be used to passthrough any
IOMMU-protected device.

It is recommended to use this option only for trusted VMs under
administrator control.

Limit the guest to using at most N event channels (PV interrupts).
Guests use hypervisor resources for each event channel they use.

The default of 1023 should be sufficient for typical guests. The
maximum value depends what the guest supports. Guests supporting the
FIFO-based event channel ABI support up to 131,071 event channels.
Other guests are limited to 4095 (64-bit x86 and ARM) or 1023 (32-bit
x86).

Selects whether to expose the host e820 (memory map) to the guest via
the virtual e820. When this option is false (0) the guest pseudo-physical
address space consists of a single contiguous RAM region. When this
option is specified the virtual e820 instead reflects the host e820
and contains the same PCI holes. The total amount of RAM represented
by the memory map is always the same, this option configures only how
it is laid out.

Exposing the host e820 to the guest gives the guest kernel the
opportunity to set aside the required part of its pseudo-physical
address space in order to provide address space to map passedthrough
PCI devices. It is guest Operating System dependent whether this
option is required, specifically it is required when using a mainline
Linux ("pvops") kernel. This option defaults to true (1) if any PCI
passthrough devices are configured and false (0) otherwise. If you do not
configure any passthrough devices at domain creation time but expect
to hotplug devices later then you should set this option. Conversely
if your particular guest kernel does not require this behaviour then
it is safe to allow this to be enabled but you may wish to disable it
anyway.

Selects the emulated virtual device to boot from. Options are hard
disk (c), cd-rom (d) or network/PXE (n). Multiple options can be
given and will be attempted in the order they are given. e.g. to boot
from cd-rom but fallback to the hard disk you can give dc. The
default is cd.

The following options control the mechanisms used to virtualise guest
memory. The defaults are selected to give the best results for the
common case and so you should normally leave these options
unspecified.

Turns "hardware assisted paging" (the use of the hardware nested page
table feature) on or off. This feature is called EPT (Extended Page
Tables) by Intel and NPT (Nested Page Tables) or RVI (Rapid
Virtualisation Indexing) by AMD. Affects HVM guests only. If turned
off, Xen will run the guest in "shadow page table" mode where the
guest's page table updates and/or TLB flushes etc. will be emulated.
Use of HAP is the default when available.

Turns "out of sync pagetables" on or off. When running in shadow page
table mode, the guest's page table updates may be deferred as
specified in the Intel/AMD architecture manuals. However this may
expose unexpected bugs in the guest, or find bugs in Xen, so it is
possible to disable this feature. Use of out of sync page tables,
when Xen thinks it appropriate, is the default.

Number of megabytes to set aside for shadowing guest pagetable pages
(effectively acting as a cache of translated pages) or to use for HAP
state. By default this is 1MB per guest vcpu plus 8KB per MB of guest
RAM. You should not normally need to adjust this value. However if you
are not using hardware assisted paging (i.e. you are using shadow
mode) and your guest workload consists of a a very large number of
similar processes then increasing this value may improve performance.

The following options allow various processor and platform level
features to be hidden or exposed from the guest's point of view. This
can be useful when running older guest Operating Systems which may
misbehave when faced with more modern features. In general you should
accept the defaults for these options wherever possible.

Loads ROMBIOS, a 16-bit x86 compatible BIOS. This is used by default
when device_model_version=qemu-xen-traditional. This is the only BIOS
option supported when device_model_version=qemu-xen-traditional. This is
the BIOS used by all previous Xen versions.

Hide or expose the IA32 Physical Address Extensions. These extensions
make it possible for a 32 bit guest Operating System to access more
than 4GB of RAM. Enabling PAE also enabled other features such as
NX. PAE is required if you wish to run a 64-bit guest Operating
System. In general you should leave this enabled and allow the guest
Operating System to choose whether or not to use PAE. (X86 only)

Expose ACPI (Advanced Configuration and Power Interface) tables from
the virtual firmware to the guest Operating System. ACPI is required
by most modern guest Operating Systems. This option is enabled by
default and usually you should omit it. However it may be necessary to
disable ACPI for compatibility with some guest Operating Systems.

Include information regarding APIC (Advanced Programmable Interrupt
Controller) in the firmware/BIOS tables on a single processor
guest. This causes the MP (multiprocessor) and PIR (PCI Interrupt
Routing) tables to be exported by the virtual firmware. This option
has no effect on a guest with multiple virtual CPUS as they must
always include these tables. This option is enabled by default and you
should usually omit it but it may be necessary to disable these
firmware tables when using certain older guest Operating
Systems. These tables have been superseded by newer constructs within
the ACPI tables. (X86 only)

Hides or exposes the No-eXecute capability. This allows a guest
Operating system to map pages such that they cannot be executed which
can enhance security. This options requires that PAE also be
enabled. (X86 only)

Enables or disables HPET (High Precision Event Timer). This option is
enabled by default and you should usually omit it. It may be necessary
to disable the HPET in order to improve compatibility with guest
Operating Systems (X86 only)

Enable or disables guest access to hardware virtualisation features,
e.g. it allows a guest Operating System to also function as a
hypervisor. This option is disabled by default. You may want this
option if you want to run another hypervisor (including another copy
of Xen) within a Xen guest or to support a guest Operating System
which uses hardware virtualisation extensions (e.g. Windows XP
compatibility mode on more modern Windows OS).

Configure the value returned when a guest executes CPUID instruction.
Two versions of config syntax are recognized: libxl and xend.

The libxl syntax is a comma separated list of key=value pairs, preceded by the
word "host". A few keys take a numerical value, all others take a single
character which describes what to do with the feature bit.

Possible values for a single feature bit:
'1' -> force the corresponding bit to 1
'0' -> force to 0
'x' -> Get a safe value (pass through and mask with the default policy)
'k' -> pass through the host bit value
's' -> as 'k' but preserve across save/restore and migration (not implemented)

Note: when specifying cpuid for hypervisor leaves (0x4000xxxx major group)
only the lowest 8 bits of leaf's 0x4000xx00 EAX register are processed, the rest
are ignored (these 8 bits signify maximum number of hypervisor leaves).

The xend syntax is a list of values in the form of
'leafnum:register=bitstring,register=bitstring'
"leafnum" is the requested function,
"register" is the response register to modify
"bitstring" represents all bits in the register, its length must be 32 chars.
Each successive character represent a lesser-significant bit, possible values
are listed above in the libxl section.

Example to hide two features from the guest: 'tm', which is bit #29 in EDX, and
'pni' (SSE3), which is bit #0 in ECX:

Specify a path to a file that contains extra ACPI firmware tables to pass in to
a guest. The file can contain several tables in their binary AML form
concatenated together. Each table self describes its length so no additional
information is needed. These tables will be added to the ACPI table set in the
guest. Note that existing tables cannot be overridden by this feature. For
example this cannot be used to override tables like DSDT, FADT, etc.

Specify a path to a file that contains extra SMBIOS firmware structures to pass
in to a guest. The file can contain a set DMTF predefined structures which will
override the internal defaults. Not all predefined structures can be overridden,
only the following types: 0, 1, 2, 3, 11, 22, 39. The file can also contain any
number of vendor defined SMBIOS structures (type 128 - 255). Since SMBIOS
structures do not present their overall size, each entry in the file must be
preceded by a 32b integer indicating the size of the next structure.

Guest rdtsc/p always emulated at 1GHz (kernel and user). Guest rdtsc/p
always emulated and the virtual TSC will appear to increment (kernel
and user) at a fixed 1GHz rate, regardless of the PCPU HZ rate or
power state; Although there is an overhead associated with emulation
this will NOT affect underlying CPU performance.

Same as native, except xen manages TSC_AUX register so guest can
determine when a restore/migration has occurred and assumes guest
obtains/uses pvclock-like mechanism to adjust for monotonicity and
frequency changes.

Specifies that periodic Virtual Platform Timers should be aligned to
reduce guest interrupts. Enabling this option can reduce power
consumption, especially when a guest uses a high timer interrupt
frequency (HZ) values. The default is true (1).

Delay for missed ticks. Do not advance a vcpu's time beyond the
correct delivery time for interrupts that have been missed due to
preemption. Deliver missed interrupts when the vcpu is rescheduled and
advance the vcpu's virtual time stepwise for each one.

No missed interrupts are held pending. Instead, to ensure ticks are
delivered at some non-zero rate, if we detect missed ticks then the
internal tick alarm is not disabled if the VCPU is preempted during
the next tick period.

The following options allow Paravirtualised features (such as devices)
to be exposed to the guest Operating System in an HVM guest.
Utilising these features requires specific guest support but when
available they will result in improved performance.

Enable or disable the Xen platform PCI device. The presence of this
virtual device enables a guest Operating System (subject to the
availability of suitable drivers) to make use of paravirtualisation
features such as disk and network devices etc. Enabling these drivers
improves performance and is strongly recommended when available. PV
drivers are available for various Operating Systems including HVM
Linux http://wiki.xen.org/wiki/XenLinuxPVonHVMdrivers and Microsoft
Windows http://wiki.xen.org/wiki/XenWindowsGplPv.

This group incorporates the Hypercall MSRs, Virtual processor index MSR,
and APIC access MSRs. These enlightenments can improve performance of
Windows Vista and Windows Server 2008 onwards and setting this option
for such guests is strongly recommended.
This group is also a pre-requisite for all others. If it is disabled
then it is an error to attempt to enable any other group.

This is a special value that enables the default set of groups, which
is currently the base, freq and time_ref_count groups.

all

This is a special value that enables all available groups.

Groups can be disabled by prefixing the name with '!'. So, for example,
to enable all groups except freq, specify:

viridian=[ "all", "!freq" ]

For details of the enlightenments see the latest version of Microsoft's
Hypervisor Top-Level Functional Specification.

The enlightenments should be harmless for other versions of Windows
(although they will not give any benefit) and the majority of other
non-Windows OSes.
However it is known that they are incompatible with some other Operating
Systems and in some circumstance can prevent Xen's own paravirtualisation
interfaces for HVM guests from being used.

The viridian option can be specified as a boolean. A value of true (1)
is equivalent to the list [ "defaults" ], and a value of false (0) is
equivalent to an empty list.

The following options control the features of the emulated graphics
device. Many of these options behave similarly to the equivalent key
in the VFB_SPEC_STRING for configuring virtual frame buffer devices
(see above).

Sets the amount of RAM which the emulated video card will contain,
which in turn limits the resolutions and bit depths which will be
available.

When using the qemu-xen-traditional device-model, the default as well as
minimum amount of video RAM for stdvga is 8 MB, which is sufficient for e.g.
1600x1200 at 32bpp. For the upstream qemu-xen device-model, the default and
minimum is 16 MB.

When using the emulated Cirrus graphics card (vga="cirrus") and the
qemu-xen-traditional device-model, the amount of video RAM is fixed at 4 MB,
which is sufficient for 1024x768 at 32 bpp. For the upstream qemu-xen
device-model, the default and minimum is 8 MB.

Select a standard VGA card with VBE (VESA BIOS Extensions) as the
emulated graphics device. The default is false (0) which means to emulate
a Cirrus Logic GD5446 VGA card. If your guest supports VBE 2.0 or
later (e.g. Windows XP onwards) then you should enable this.
stdvga supports more video ram and bigger resolutions than Cirrus.
This option is deprecated, use vga="stdvga" instead.

Configure the keymap to use for the keyboard associated with this
display. If the input method does not easily support raw keycodes
(e.g. this is often the case when using VNC) then this allows us to
correctly map the input keys into keycodes seen by the guest. The
specific values which are accepted are defined by the version of the
device-model which you are using. See Keymaps below or consult the
qemu(1) manpage. The default is en-us.

Enable OpenGL acceleration of the SDL display. Only effects machines
using device_model_version="qemu-xen-traditional" and only if the
device-model was compiled with OpenGL support. False (0) by default.

Specify the secure port to listen on by the SPICE server if the SPICE
is enabled. At least one of the spiceport or spicetls_port must be
given if SPICE is enabled. NB. the options depending on spicetls_port
have not been supported.

Enables spice vdagent. The Spice vdagent is an optional component for
enhancing user experience and performing guest-oriented management
tasks. Its features includes: client mouse mode (no need to grab mouse
by client, no mouse lag), automatic adjustment of screen resolution,
copy and paste (text and image) between client and domU. It also
requires vdagent service installed on domU o.s. to work. The default is 0.

Enables spice usbredirection. Creates NUMBER usbredirection channels
for redirection of up to 4 usb devices from spice client to domU's qemu.
It requires an usb controller and if not defined it will automatically adds
an usb2 controller. The default is disabled (0).

Redirect virtual serial ports to DEVICEs. Please see the
-serial option in the qemu(1) manpage for details of the valid
DEVICE options. Default is vc when in graphical mode and
stdio if nographics=1 is used.

Select the virtual sound card to expose to the guest. The valid
devices are defined by the device model configuration, please see the
qemu(1) manpage for details. The default is not to export any sound
device.

Specifies the type of an emulated USB bus in the guest. 1 for usb1,
2 for usb2 and 3 for usb3, it is available only with upstream qemu.
Due to implementation limitations this is not compatible with the usb
and usbdevice parameters.
Default is 0 (no usb controller defined).

Adds DEVICEs to the emulated USB bus. The USB bus must also be
enabled using usb=1. The most common use for this option is
usbdevice=['tablet'] which adds pointer device using absolute
coordinates. Such devices function better than relative coordinate
devices (such as a standard mouse) since many methods of exporting
guest graphics (such as VNC) work better in this mode. Note that this
is independent of the actual pointer device you are using on the
host/client side.

Host devices can also be passed through in this way, by specifying
host:USBID, where USBID is of the form xxxx:yyyy. The USBID can
typically be found by using lsusb or usb-devices.

If you wish to use the "host:bus.addr" format, remove any leading '0' from the
bus and addr. For example, for the USB device on bus 008 dev 002, you should
write "host:8.2".

The form usbdevice=DEVICE is also accepted for backwards compatibility.

More valid options can be found in the "usbdevice" section of the qemu
documentation.

The following options control the selection of the device-model. This
is the component which provides emulation of the virtual devices to an
HVM guest. For a PV guest a device-model is sometimes used to provide
backends for certain PV devices (most usually a virtual framebuffer
device).

Use the device-model based upon the historical Xen fork of Qemu.
This device-model is still the default for NetBSD dom0.

It is recommended to accept the default value for new guests. If
you have existing guests then, depending on the nature of the guest
Operating System, you may wish to force them to use the device
model which they were installed with.

Override the path to the binary to be used as the device-model. The
binary provided here MUST be consistent with the
`device_model_version` which you have specified. You should not
normally need to specify this option.